UBB.threads PHP Forum Software Community Forums UBB.threads 6 Version 6 Support Hacked, Upgraded, and Problems

My board v. 6.4.1 was hacked tonight, so I upgraded to the latest version. I'm having a few major issues though. When I try to login, all that I get is a black screen. I'm also unable to get rid of the hacker message despite replacing all of the files for the board with the latest versions. Here's the site: http://www.nittanyfootball.com/ubbthreads/ubbthreads.php

If I can get the admin login issue fixed, I think that will be the biggest issue because I'll at least be able to poke around the admin panel. Any help would be greatly appreciated.

Thank,
Mark

It looks ok to me, but you need to go through every file on your site, including .htaccess files. <img src="https://www.ubbcentral.com/boards/images/graemlins/frown.gif" alt="" />

Allen,
Thank...I was up until 1am last night going through everything and finally fixed it...I think. Seems to be working for the most part now.

This guy got me good.. <img src="https://www.ubbcentral.com/boards/images/graemlins/frown.gif" alt="" />

[]Yesterday the Turkish cracker going by the handle "Iskorpitx", succesfully hacked 21,549 websites in one shot (plus 17,000 as our last update) and defaced (on a secondary page) all of them with a message showing the Turkish flag (with AtaTurk face on it) and reporting:

"HACKED BY iSKORPiTX

(TURKISH HACKER) [/]

I had a different guy...or group. It was just as bad and was the reason I spent 4 hours fixing it and upgrading last night. Jerks.

Yeh, my local machine got nailed as well; I didn't bother upgrading it as it's a controlled enviroment, i just nuked the web partition lol...

Here is the info

http://www.zone-h.org/news/read/id=206009

BUT it says it is an asp, my server is unix, i thought asp files did not run on unix??

My first infected file was on an older backup ubbthread folder, that was not active. I was not even aware that it could find such a thing. I first thought something was wrong when i ftped into my site and did a sort by day, then saw my old back upfolder was the most current......

live and learn on that one

You can install handlers to allow ASP files in Unix; just as you can install PHP on Windows.

Mine was in /private/test/threads where all directories weren't even indexed by apache so i was sort of baffeled as well.

Yup, my site got done as well.
I'm confused as to (a) how it was done, and (b) how i can prevent it happening again.

Did not take too much time to get me back up again, however i have not yet checked every folder to see what else has been hacked, as i run several sites from the same root server.

Any pointers as to what files/directories to look for would be appreciated.

Thanks

a) security hole in a couple scripts allowed hacker to upload scripts to gain root access to server

b) update to latest 6.5.4 files to fix security holes.

Could be any file or directory - I'd first take a closer look at all .php and .pl files - I found one named l.php that gave shell access to the whole server. Another named mysql.php that gave access to databases. Another was dl.pl (or something similar) which was a perl shell app if I remember right. Also check .htaccess files for unusual entries.

rats,,,, I had some files changed this afternoon to the same turkey webpage... with this afternoons time on it...

How can I stop this guy?????